6e6afb4cbcb63171359f9b0f4375e9bc41bf29189c18f52789e445e4bcb6c52a

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 1.6MB
Sample261003-pl2agada95
SHA256 6e6afb4cbcb63171359f9b0f4375e9bc41bf29189c18f52789e445e4bcb6c52a
MD5 55cc9ad26162ae6ac7fcde4e9285b918
SHA1 60dd8b3cd2aa278e0e4d95bbc491e7158b3051ce
SHA512 d64c28e853079eeeec0987dc778cf8e67049ac8325995f801fa08daf9038570e0869b0a95d8a0eaeb703fb71570fd835dd3fa35a4207d3a2b22c797811bdfbdb
SSDEEP 24576:2Y9sj5KkX4Gy+4f7aCvUT739+LHK8mm9U/HPo78UsENMnEj:2Y9sjskXjym73ErK8mCUef2E
TLSH
T184757D47F56680EDC17DC131875A6126BB35784D47283EEB3BDC42217F62BE06A3AB09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_55cc9ad26162ae6ac7fcde4e9285b918_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.bin

Path C:\Users\Admin\AppData\Local\Temp\logs.bin
Size 1KB
SHA256 5d67ce9eb99d451069396c393bc51819d6a0154951a273de840f22c8c03b5d84
MD5 dc263ad65fb636ad82b3bcf81718fa1d
SHA1 7c70052ea10745cc905c25d9c3d36b2acee567dd
SHA512 2ad7f61d8f9287733b4c127c12c0a38d2f05d933321d3ed73110f0a9fd8c9f389e7c8d39bb82e28dea3a6d16a6b56a72362ab97c799f621555e3144268c28f9f
TLSH
T17E21B73164877AF7021DEB3D8B812D204E9D0C4188CDB25C4B544A695F57A9538B24F1
MD5 SHA1 SHA512 TLSH

Submit Download